Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

Tools

All Android Security Authentication & Authorization Cloud Infrastructure Security Defensive Tools Disk Forensics Embedded Systems Security General Purpose Utilities Indicator of Compromise (IOC) Management OSINT (Open Source Intelligence)Packet Sniffing & Analysis Password Cracking Penetration Testing Frameworks Phishing Tools Privilege Escalation Reconnaissance Static Analysis Vulnerability Scanners Web Vulnerability Scanners Wi-Fi Auditing Bluetooth Security Container Security Dynamic Analysis (Sandboxing)Encryption/Decryption Tools Exploit Frameworks Identity Management iOS Security IoT Security Memory Forensics Network Mapping OSINT for Social Engineering Password Attacks Payload Generation Persistence Mechanisms Port Scanning Static Code Analysis (SAST)Threat Feeds & Aggregators Vulnerability Analysis Web Proxies & Interception Code Analysis DNS & Subdomain Enumeration Dynamic Code Analysis (DAST)Exploitation Hash Analysis IDS/IPS Evasion Impersonation Tools Lateral Movement Mobile App Pentesting Network Forensics Reverse Engineering RFID/NFC Tools SCADA/ICS Security Scripting & Automation Serverless Security Shellcode Web Application Exploitation API Security Testing Configuration Auditing Data Exfiltration Debuggers Forensics Information Gathering Mobile Forensics Network Access Control Post-Exploitation Security Virtualization Phishing WAF Bypass Web Security Fuzzing Network Security Steganography Wireless Security Data Recovery Malware Analysis Digital Forensics Hardware Hacking Cryptography CTF Penetration Testing Cloud Security DevSecOps Mobile Security Privacy Command and Control Social Engineering Hardware Security Utilities & Frameworks Hardware & IoT Security Secret Detection Binary Analysis Threat Intelligence Identity & Access Management (IAM)Supply Chain Security Authentication Machine Learning Intrusion Detection Papers & Research Misconfiguration Subdomain Enumeration Email Harvesting Learning & Education AI-Assisted Reversing DNS Fuzzing Red Teaming Incident Response Crawler Curated Resources Remote Access Tool Shellcode Generation Payload Development Remote Access Trojan API Security Anti-Bot Fingerprint Spoofing CAPTCHA Bypass Email Security DNS Analysis Chaos Engineering Learning Paths & Courses Container Escape AI Security Database Security Firmware Analysis Anomaly Detection Log Analysis Adversarial Attack Binary Exploitation Labs & Practice

Newest Relevance Most popular Recently updated

57 results

joomla-bruteforce

ajnik/joomla-bruteforce

Python script that brute-forces Joomla administrator login credentials using wordlists, with proxy and verbose options for penetration testing.

authenticationpassword-attackspassword-cracking+4

138

2 years ago

Kousei

nu11secur1ty/kousei

Python/Go framework that generates SQL injection PoC requests, automates sqlmap attacks, and manages modular exploit scripts with parameter detection…

exploitationpassword-crackingpayload-generation+6

38 days ago

CVE-2019-9053

4nner/cve-2019-9053

Python 3 exploit for CVE-2019-9053, a CMS Made Simple SQL injection vulnerability, enabling credential extraction via time-based blind SQLi and…

exploitationpassword-crackingpenetration-testing+3

113 years ago

CVE-2026-77771

pervinzahidli/cve-2026-77771

Advisory for CVE-2026-77771, a 2FA bypass in the miniOrange WordPress plugin via session-scoped OTP lockout, with impact analysis and remediation…

authenticationdefensive-toolseducation+2

27 days ago

Exploit-CVE-2023-6063-PoC-Vuln

zhairiazzeddine/exploit-cve-2023-6063-poc-vuln

Python PoC for CVE-2023-6063, an unauthenticated time-based blind SQL injection in WP Fastest Cache <=1.2.2, extracting WordPress password hashes and…

exploitationpassword-crackingpenetration-testing+4

29 days ago

godirb

mycode83/godirb

Fast and easy-to-use directory brute-forcer written in Go.

fuzzinginformation-gatheringpenetration-testing+3

521 days ago

crackerjack

sadreck/crackerjack

Web-based GUI for Hashcat that simplifies password cracking with session management, mask generation, wordlist support, and multi-user access.

cryptographyhash-analysispassword-cracking+3

641 year ago

HotelDruid-CVE-2021-42949

dhammon/hoteldruid-cve-2021-42949

Exploit for CVE-2021-42949 in HotelDruid v3.0.3, demonstrating predictable session token generation and authentication bypass via brute force.

authenticationexploitationpenetration-testing+2

4 years ago

custom-oscp-tooling

wattocyber/custom-oscp-tooling

OSCP-focused toolkit for read-only network, SMB, AD, DNS, web, and database enumeration; privesc scanning, hash identification, and…

database-securitydns-analysishash-analysis+9

1 month ago

CVE-2026-22016-IPFS-CID-Spoofing-via-Multihash-Length-Extension

george0papasotiriou/cve-2026-22016-ipfs-cid-spoofing-via-multihash-length-extension

Python proof-of-concept demonstrating IPFS CID spoofing via multihash length extension, highlighting content-addressing verification flaws that can…

adversarial-attackcryptographyexploitation+3

2 months ago

JWT_Brute

jas502n/jwt_brute

JWT_Brute

authenticationpassword-crackingpenetration-testing+1

317 years ago

insect

nu11secur1ty/insect

High-performance web path discovery and directory brute-forcing tool. Discovers hidden files, directories, and endpoints using customizable…

fuzzinginformation-gatheringpenetration-testing+3

3 years ago

wpbf

dejanlevaja/wpbf

WPBF - a multithreaded WP brute forcer

authenticationinformation-gatheringpassword-attacks+2

512 years ago

vbrute

nccgroup/vbrute

Virtual host brute forcer

information-gatheringnetwork-mappingreconnaissance+1

2212 years ago

hackerone

besioo/hackerone

Brute-force scraper for HackerOne disclosed reports via their public API, collecting report IDs, links, titles, and states for security research and…

educationinformation-gatheringosint+3

572 years ago

FavFreak

devanshbatham/favfreak

Making Favicon.ico based Recon Great again !

crawlerhash-analysisinformation-gathering+3

1.3k3 years ago

Venom-JWT

z-bool/venom-jwt

针对JWT渗透开发的漏洞验证/密钥爆破工具，针对CVE-2015-9235/空白密钥/未验证签名攻击/CVE-2016-10555/CVE-2018-0114/CVE-2020-28042的结果生成用于FUZZ，也可使用字典/字符枚举(包括JJWT)的方式进行爆破(JWT Crack)

exploitationfuzzingpassword-cracking+3

2881 year ago

CVE-2025-65900

noxurge/cve-2025-65900

DifuseHQ Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient…

authenticationexploitationmisconfiguration+3

10 months ago

Previous12 3 4 Next